Featured Research

from universities, journals, and other organizations

Weakness In Internet Security Uncovered

Date:

January 1, 2009

Source:

Ecole Polytechnique Fédérale de Lausanne

Summary:

Independent security researchers have found a weakness in the Internet digital certificate infrastructure that allows attackers to forge certificates that are fully trusted by all commonly used web browsers.

Share This

Independent security researchers in California and researchers at the Centrum Wiskunde & Informatica (CWI) in the Netherlands, EPFL in Switzerland, and Eindhoven University of Technology (TU/e) in the Netherlands have found a weakness in the Internet digital certificate infrastructure that allows attackers to forge certificates that are fully trusted by all commonly used web browsers.

Related Articles

As a result of this weakness it is possible to impersonate secure websites and email servers and to perform virtually undetectable phishing attacks, implying that visiting secure websites is not as safe as it should be and is believed to be. By presenting their results at the 25C3 security congress in Berlin on the 30th of December, the experts hope to increase the adoption of more secure cryptographic standards on the Internet and therewith increase the safety of the internet.

When you visit a website whose URL starts with "https", a small padlock symbol appears in the browser window. This indicates that the website is secured using a digital certificate issued by one of a few trusted Certification Authorities (CAs). To ensure that the digital certificate is legitimate, the browser verifies its signature using standard cryptographic algorithms. The team of researchers has discovered that one of these algorithms, known as MD5, can be misused.

The first significant weakness in the MD5 algorithm was presented in 2004 at the annual cryptology conference "Crypto" by a team of Chinese researchers. They had managed to pull off a so-called "collision attack" and were able to create two different messages with the same digital signature. While this initial construction was severely limited, a much stronger collision construction was announced by the researchers from CWI, EPFL and TU/e in May 2007. Their method showed that it was possible to have almost complete freedom in the choice of both messages. The team of researchers has now discovered that it is possible to create a rogue certification authority (CA) that is trusted by all major web browsers by using an advanced implementation of the collision construction and a cluster of more than 200 commercially available game consoles.

The team of researchers has thus managed to demonstrate that a critical part of the Internet's infrastructure is not safe. A rogue CA, in combination with known weaknesses in the DNS (Domain Name System) protocol, can open the door for virtually undetectable phishing attacks. For example, without being aware of it, users could be redirected to malicious sites that appear exactly the same as the trusted banking or e-commerce websites they believe to be visiting. The web browser could then receive a forged certificate that will be erroneously trusted, and users' passwords and other private data can fall in the wrong hands. Besides secure websites and email servers, the weakness also affects other commonly used software.

"The major browsers and Internet players – such as Mozilla and Microsoft – have been contacted to inform them of our discovery and some have already taken action to better protect their users," reassures Arjen Lenstra, head of EPFL's Laboratory for Cryptologic Algorithms. "To prevent any damage from occurring, the certificate we created had a validity of only one month – August 2004 – which expired more than four years ago. The only objective of our research was to stimulate better Internet security with adequate protocols that provide the necessary security."

According to the researchers, their discovery shows that MD5 can no longer be considered a secure cryptographic algorithm for use in digital signatures and certificates. Currently MD5 is still used by certain certificate authorities to issue digital certificates for a large number of secure websites. "Theoretically it has been possible to create a rogue CA since the publication of our stronger collision attack in 2007," says cryptanalyst Marc Stevens (CWI). "It's imperative that browsers and CAs stop using MD5, and migrate to more robust alternatives such as SHA-2 and the upcoming SHA-3 standard," insists Lenstra.

More From ScienceDaily

More Computers & Math News

Featured Research

Mar. 3, 2015 — By examining the forces that the segments of mosquito legs generate against a water surface, researchers have unraveled the mechanical logic that allows the mosquitoes to walk on water, which may ... full story

Mar. 3, 2015 — Major cities in the UK are falling behind their international counterparts in terms of their use of smart technologies, according to a new study. The research has found that smart cities in the UK, ... full story

Mar. 3, 2015 — To simulate chimp behavior, scientists created a computer model based on equations normally used to describe the movement of atoms and molecules in a confined space. An interdisciplinary research ... full story

Mar. 3, 2015 — Magnetic vortex structures, so-called skyrmions, could in future store and process information very efficiently. They could also be the basis for high-frequency components. For the first time, a team ... full story

Mar. 2, 2015 — The odds of picking a perfect bracket for the NCAA men's basketball March Madness championship tournament are a staggering less than one in 9.2 quintillion (that's 9,223,372,036,854,775,808), ... full story

Mar. 2, 2015 — Scientists report that they could observe experimentally the current flow along channels at the crystal surfaces of topological insulators. The channels are less than one nanometer wide and extend ... full story

Mar. 2, 2015 — Organic light emitting diodes (OLEDs), which are made from carbon-containing materials, have the potential to revolutionize future display technologies, making low-power displays so thin they'll wrap ... full story

Mar. 2, 2015 — What if one day, your computer, TV or smart phone could process data with light waves instead of an electrical current, making those devices faster, cheaper and more sustainable through less heat and ... full story

Mar. 2, 2015 — 3-D printing could become a powerful tool in customizing interventional radiology treatments to individual patient needs, with clinicians having the ability to construct devices to a specific size ... full story

Featured Videos

Forensic Holodeck Creates 3D Crime Scenes

Reuters - Innovations Video Online (Mar. 3, 2015) — A holodeck is no longer the preserve of TV sci-fi classic Star Trek, thanks to researchers from the Institute of Forensic Medicine Zurich, who have created what they say is the first system in the world to visualise the 3D data of forensic scans. Jim Drury saw it in operation.
Video provided by Reuters

Related Stories

Nov. 7, 2014 — A detailed analysis by cybersecurity experts found that U.S. website administrators nationwide tasked with patching security holes exploited by the Heartbleed bug may not have done ... full story

June 20, 2011 — Scientists in Germany have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which ... full story

May 24, 2011 — Researchers have developed an anonymous system with automatic routing management. The system sets up a data transmission communication environment whose users are unidentifiable. This safeguards user ... full story

July 2, 2010 — Most educational websites in the US are using Flash applications that fail to adequately secure these pages. This is a growing problem for the Internet as vulnerable sites can be hijacked for ... full story

ScienceDaily features breaking news and videos about the latest discoveries in health, technology, the environment, and more -- from major news services and leading universities, scientific journals, and research organizations.